1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:

procedure AsmBegin;
asm
  //int 3
  NOP
  NOP
  NOP
  PUSH $64                    // TaskSwitch
  CALL DWORD PTR [$00000000]  // Sleep
  PUSH DWORD PTR [$00000018]  // ProcessHandle
  PUSH 0
  PUSH PROCESS_ALL_ACCESS
  CALL DWORD PTR [$00000004]  // OpenProcess
  TEST EAX, EAX
  JZ @@Terminated
  PUSH EAX
  CALL DWORD PTR [$00000008]  // TerminateProcess
  TEST EAX, EAX
  POP EAX
  CALL DWORD PTR [$0000000C]  // CloseHandle
  PUSH 1000                   // TaskSwitch [Process terminating]
  CALL DWORD PTR [$00000000]  // Sleep

@@Terminated:
  PUSH [$0000001C] // StringOffset
  CALL [$00000010] // DeleteFileA
  PUSH 0
  CALL [$00000014] // ExitProcess
  RET
end;
procedure AsmEnd; asm end;

procedure CloseAndDeleteMe;
var pTempMem: Pointer;
    pTargetMem: Pointer;
    sFile: String;
    dwMemSize: DWord;
    dwAsmSize: DWord;
    lpStartupInfo: TStartupInfo;
    lpProcessInformation: TProcessInformation;

    pSleep: Pointer;
    pOpenProcess: Pointer;
    pTerminateProcess: Pointer;
    pCloseHandle: Pointer;
    pDeleteFileA: Pointer;
    pExitProcess: Pointer;

    dwKernelHandle: DWord;
    dwBytesWritten: DWord;
    dwThreadID: DWord;
begin
  dwKernelHandle := GetModuleHandle('kernel32.dll');

  pSleep := GetProcAddress(dwKernelHandle,'Sleep');
  pOpenProcess := GetProcAddress(dwKernelHandle,'OpenProcess');
  pTerminateProcess := GetProcAddress(dwKernelHandle,'TerminateProcess');
  pCloseHandle := GetProcAddress(dwKernelHandle,'CloseHandle');
  pDeleteFileA := GetProcAddress(dwKernelHandle,'DeleteFileA');
  pExitProcess := GetProcAddress(dwKernelHandle,'ExitProcess');

  sFile := Paramstr(0);

  dwAsmSize := DWord(@AsmEnd)-DWord(@AsmBegin);
  dwMemSize := dwAsmSize+DWord(Length(sFile))+1+$20*Sizeof(DWord);
  ZeroMemory(@lpStartupInfo,SizeOf(lpStartupInfo));
  lpStartupInfo.cb := SizeOf(lpStartupInfo);
  if CreateProcessA(nil,'explorer',nil,nil,false,CREATE_SUSPENDED,nil,
    nil,lpStartupInfo,lpProcessInformation) then
  begin
    pTempMem := VirtualAlloc(nil,dwMemSize,MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
    if (pTempMem = nil) then
      Exit;
    pTargetMem := VirtualAllocEx(lpProcessInformation.hProcess,nil,dwMemSize,MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE);
    if (pTargetMem = nil) then
    begin
      VirtualFree(pTempMem,dwMemSize,MEM_RELEASE);
      Exit;
    end;
    CopyMemory(pTempMem,@AsmBegin,dwAsmSize);
    CopyMemory(Pointer(DWord(pTempMem)+$20+dwAsmSize),@sFile[1],Length(sFile));

    PPointer(DWord(pTempMem)+dwAsmSize+$00)^ := pSleep;
    PPointer(DWord(pTempMem)+dwAsmSize+$04)^ := pOpenProcess;
    PPointer(DWord(pTempMem)+dwAsmSize+$08)^ := pTerminateProcess;
    PPointer(DWord(pTempMem)+dwAsmSize+$0C)^ := pCloseHandle;
    PPointer(DWord(pTempMem)+dwAsmSize+$10)^ := pDeleteFileA;
    PPointer(DWord(pTempMem)+dwAsmSize+$14)^ := pExitProcess;
    PDWord(DWord(pTempMem)+dwAsmSize+$18)^ := GetCurrentProcessID;
    PDWord(DWord(pTempMem)+dwAsmSize+$1C)^ := DWord(pTargetMem)+dwAsmSize+$20;

    PDWord(DWord(pTempMem)+07)^ := DWord(pTargetMem)+dwAsmSize+$00;
    PDWord(DWord(pTempMem)+26)^ := DWord(pTargetMem)+dwAsmSize+$04;
    PDWord(DWord(pTempMem)+37)^ := DWord(pTargetMem)+dwAsmSize+$08;
    PDWord(DWord(pTempMem)+46)^ := DWord(pTargetMem)+dwAsmSize+$0C;
    PDWord(DWord(pTempMem)+57)^ := DWord(pTargetMem)+dwAsmSize+$00;
    PDWord(DWord(pTempMem)+69)^ := DWord(pTargetMem)+dwAsmSize+$10;
    PDWord(DWord(pTempMem)+77)^ := DWord(pTargetMem)+dwAsmSize+$14;

    PDWord(DWord(pTempMem)+13)^ := DWord(pTargetMem)+dwAsmSize+$18;
    PDWord(DWord(pTempMem)+63)^ := DWord(pTargetMem)+dwAsmSize+$1C;

    if WriteProcessMemory(lpProcessInformation.hProcess,pTargetMem,pTempMem,dwMemSize,dwBytesWritten)
      and (dwBytesWritten = dwMemSize) then
      CreateRemoteThread(lpProcessInformation.hProcess,nil,0,pTargetMem,nil,0,dwThreadID);
    ExitProcess(0);
  end;
end;


procedure TForm1.Button1Click(Sender: TObject);
begin
  CloseAndDeleteMe;
end;